Reply to thread

Message

<blockquote data-quote="ForgottenSeer 92963" data-source="post: 973873">[USER=59691]@SecureKongo[/USER] and [USER=81799]@ErzCrz[/USER]Simple Windows Hardening blocks running scripts in user space and optionally sets some registry keys to make powershell less prone to misuse. SWH also has an option to disable Wscript&nbsp; but not CMD (I have had a long conversation with Andy on this, but I could not convince him to add that also).With Hard_Configurator you can also block executing sponsors. H_C in recommended settings allows admins to overrule the Software Restriction Policies. This means you can always install stuf by right-click &quot;run as admin&quot;. On top of that H_C has two usability modes to make life easier for you:<ol>
<li data-xf-list-type="ol">Update mode (set to ON) 
This allows software to update&nbsp; from the ProgramData and %UserProfile%\AppData folders (by allowing EXE, MSI and TMP). Most installed software updates from Temp folder or their own folders in ProgramData or AppData. This is like SWH only for two specified folders. 
 
</li>
<li data-xf-list-type="ol">Allow EXE, TMP and MSI (globally) 
This is basically the same as SWH, only with the added security to block sponsors as well.</li>
</ol>Link to manual: <a href="https://github.com/AndyFul/Hard_Configurator/blob/master/Documentation/Hard_Configurator%20-%20Manual.pdf" target="_blank">Hard_Configurator/Hard_Configurator - Manual.pdf at master · AndyFul/Hard_Configurator</a>To reassure you: I block sponsors since I am running a Windows Pro version (XP Pro), since Windows10 (I think from 2019) I am also blocking CMD and Wscript through Group Policy for current User with no problems (but I am running a Microsoft Office + Edge setup with SyncBack Free and Macrium Free on my standard user and additionally FileZilla plus Visual Studio on my admin account).</blockquote>

[QUOTE="ForgottenSeer 92963, post: 973873"] [USER=59691]@SecureKongo[/USER] and [USER=81799]@ErzCrz[/USER] Simple Windows Hardening blocks running scripts in user space and optionally sets some registry keys to make powershell less prone to misuse. SWH also has an option to disable Wscript but not CMD (I have had a long conversation with Andy on this, but I could not convince him to add that also). With Hard_Configurator you can also block executing sponsors. H_C in recommended settings allows admins to overrule the Software Restriction Policies. This means you can always install stuf by right-click "run as admin". On top of that H_C has two usability modes to make life easier for you: [LIST=1] [*]Update mode (set to ON) This allows software to update from the ProgramData and %UserProfile%\AppData folders (by allowing EXE, MSI and TMP). Most installed software updates from Temp folder or their own folders in ProgramData or AppData. This is like SWH only for two specified folders. [*]Allow EXE, TMP and MSI (globally) This is basically the same as SWH, only with the added security to block sponsors as well. [/LIST] Link to manual: [URL='https://github.com/AndyFul/Hard_Configurator/blob/master/Documentation/Hard_Configurator%20-%20Manual.pdf']Hard_Configurator/Hard_Configurator - Manual.pdf at master · AndyFul/Hard_Configurator[/URL] To reassure you: I block sponsors since I am running a Windows Pro version (XP Pro), since Windows10 (I think from 2019) I am also blocking CMD and Wscript through Group Policy for current User with no problems (but I am running a Microsoft Office + Edge setup with SyncBack Free and Macrium Free on my standard user and additionally FileZilla plus Visual Studio on my admin account). [/QUOTE]

Verification